[Bro] using Bro as traffic analyzer.

[Readon Shaw]

>>
>>  At the same time, roughly packet loss rate (vs different timescales)
>> should be calculated
>> by tcp retransmission rate.
>>
>
>Are you interested in the packet loss rate for the three-way handshake
>only, or for all retransmissions in each connection?
>
all retransmissions should be collected.
>What level of detail are you looking for? (IE. Just that the segment was
>retransmitted or perhaps more specific data about how it was retransmitted
>such as in response to a retransmission timeout or other recovery method?)
it would be better that retrans mode were detected.
>
>-- 
>*- *James Swaro*
>*
>

--------------
Readon Shaw